DFIRHub

Windows event log ยท Microsoft-Windows-SMBServer/Operational1017 Handle scavenged

Event Viewer Guidance: The server closed a handle that was previously reserved for a client after 60 seconds. You should expect this event on a computer that is continuously available where a client did not gracefully close its session. For instance, this may occur when the client unexpectedly restarted.

  • Windows operational
  • 6 fields
  • Microsoft-Windows-SMBServer%4Operational.evtx
  • Microsoft-Windows-SMBServer

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • ExecutableInfoFileName: %FileName%
    • %FileName% = /Event/UserData/EventData/FileName
  • PayloadData1ShareName: %ShareName%
    • %ShareName% = /Event/UserData/EventData/ShareName
  • PayloadData3PersistentFileID: %PersistentFID%
    • %PersistentFID% = /Event/UserData/EventData/PersistentFID
  • PayloadData4VolatileFileID: %VolatileFID%
    • %VolatileFID% = /Event/UserData/EventData/VolatileFID
  • PayloadData5DurableHandle: %DurableHandle%
    • %DurableHandle% = /Event/UserData/EventData/DurableHandle
  • PayloadData6ResilientHandle: %ResilientHandle%
    • %ResilientHandle% = /Event/UserData/EventData/ResilientHandle

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-SMBServer" Guid="d48ce617-33a2-4bc3-a5c7-11aa4f29619e"/>
    <EventID>1017</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1017</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000008</Keywords>
    <TimeCreated SystemTime="2017-08-02 20:31:41.7566798"/>
    <EventRecordID>506</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="5796"/>
    <Channel>Microsoft-Windows-SMBServer/Operational</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <EventData>
      <DurableHandle>True</DurableHandle>
      <ResilientHandle>False</ResilientHandle>
      <PersistentFID>0x1000679180</PersistentFID>
      <VolatileFID>0x10FFFFFFFF</VolatileFID>
      <ResumeKey>b7a70b03-5818-11e6-a91a-a213a1b67900</ResumeKey>
      <ShareNameLength>11</ShareNameLength>
      <ShareName>Departments</ShareName>
      <FileNameLength>28</FileNameLength>
      <FileName>NAMEOFSHARE\NAMEOFDOCUMENT.ext</FileName>
    </EventData>
  </UserData>
</Event>

References

4 links

Source: evtx/Maps/Microsoft-Windows-SMBServer-Operational_Microsoft-Windows-SMBServer_1017.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)